Analysis
-
max time kernel
3s -
max time network
245s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
25-08-2024 07:07
Static task
static1
Behavioral task
behavioral1
Sample
clear.apk
Resource
android-x86-arm-20240624-en
General
-
Target
clear.apk
-
Size
4.8MB
-
MD5
557d3b324e38e97004125d73e3c265bf
-
SHA1
c142025f6e058a2691fd21607e66fed61ac91b3a
-
SHA256
11c67c555c1ba93694cca7c15aefca46faad7db63f0c3e0dc52c103ca435d30a
-
SHA512
37c33b04c3b8f7bca9f2b2ded649d7740b08bc6adff0226d654938ca9782f621dba0baf4468bc32fc0f3a5c40efac0ff32e086180aadaa2067d39bc50a350f72
-
SSDEEP
49152:HRsEX9rGbtKooj7s45iS7xrGPGO7ttTjVKScjPYFogGMYRCOSa+C:HRs+CtFoj7l5iSRG7vVKtEG4E1
Malware Config
Signatures
-
Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
-
Octo payload 1 IoCs
Processes:
resource yara_rule /data/user/0/com.machine_applicationlf28/[email protected] family_octo -
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.machine_applicationlf28ioc pid process /data/user/0/com.machine_applicationlf28/[email protected] 4922 com.machine_applicationlf28 -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.machine_applicationlf28description ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.machine_applicationlf28
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD5046a414913add6f5bb60072c7db819b6
SHA1451ee4f6809260aec622d772fd329c7d0297a842
SHA256b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a
SHA5124e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c
-
Filesize
322KB
MD577dc50489b9323274732d27dc8a4e803
SHA10e02a3595b62489d0739d771881da8604d117c65
SHA256c5684e792d1ebefea6aac09fed45911703fd58c899f8a08133d49dd91429a820
SHA5120684a92f3e9c525384cfa53f531afba61e5930e1c27032a7e27e3315f72761b62e122dc34768d8162ba08f9bed53d148aa8dc034b46456bdd211f230637eba58
-
/data/data/com.machine_applicationlf28/oat/x86_64/[email protected]
Filesize170B
MD5a5fc77024e7d6b013e8564866aa1dc13
SHA1ecb8b55800705cd7b03ec14e0689ae85070a3b43
SHA25693d690d1883aeb28e390837f925b5f9956d75e705e1b571cdecea1d2d1f21e2e
SHA5126337b0b30451c2e2cbc3edd7170670ad1f0c3858a9cdefdf74f9ffba04151f2ed58a384202f58cb12d10e8374a9582dc61cf1d9bf30a3583b8eb036b84770bd4
-
/data/user/0/com.machine_applicationlf28/[email protected]
Filesize526KB
MD5e288b4389026a4be2fe8c2d44c4234c8
SHA1e8eab7478f924492b48b070de2a473fa72ab2ead
SHA2560dc1451e270547123ac13878079c693adb06589fb606240c03611ade225c4295
SHA512db8a318d398c8ce14c7a30a1a013ed691415146fcce38593cb84b0ee27326f6972b349f8a1da693f26930c24254af8eb6b4a7ccb7f1c723247bcf7d34c195675